blog
The retention period of employees' personal data
A real headache for companies
In order to ensure compliance with the principle of "minimization" of personal data, the French Data Protection Authority (Commission Nationale de l'Informatique et des Libertés) endeavors to limit as much as possible the length of time they are kept. It does not hesitate to heavily sanction companies that fail to provide for a precise period of retention of this data, that provide for a period deemed excessive or that exceed the period provided for in their internal policy.
The CNIL's concern is understandable especially when it comes to avoiding that data that is no longer useful for the purpose pursued by the company (managing customers, employees, suppliers, etc. for example) is kept eternally, at the risk of being revealed in the event of cyber-attacks when it should have been removed from the files. The CNIL is less understandable when it advocates the rapid deletion of data that could be useful.
Let's take the example of personnel files.
In the absence of any legislation to this effect, the CNIL recommends deleting the CVs of job applicants who have not been selected, either immediately or within two years if the applicant is informed. However, a company may not retain a candidate and find out two or three years later that the person it hired is not satisfactory, or the employee may leave the company voluntarily after two or three years. In this case, it is in the best interest of the former second or third choice candidate to allow the company to contact him or her again to fill the position, without reopening the selection procedure if it considers it unnecessary.
Another example: the CNIL recommends on its website to delete the geolocation data of employees whose activities lead them to make rounds, within a period of two months extended to one year when it is not possible to prove the interventions made "by another means". Why two months, an extremely short period of time? And why such a reversal of the burden of proof on the company, when logically it should be up to the authority that imposes a rule not provided for by the law to prove the necessity of it?
Last but not least: whether it is the CNIL or the regulation issued by the French labor code, the data retention requirements linked to long prescriptions are not always taken into account. We can cite the statute of limitations of : (1) 10 years in criminal matters, not to mention continuous offenses for which the statute of limitations begins to run from the discovery of the offense, which is the case for many business or financial offenses that may be discovered long after the employee has left the company; (ii) 10 years from the time of the claim for compensation for the anxiety loss of victims of asbestos exposure. Moreover, there are diseases with a long incubation period that affect the person only in the very long term and at that point, it may be necessary, in order to prove the employer's fault, exonerate it or reduce it, to have access to data relating to a former employee who fell ill.
These examples only illustrate the difficulty of establishing rules for retention, i.e., deletion of data, that do not backfire on the employees themselves or those who employed them. Unless the legislation is imperative (and if it is inadequate, it must be changed), it would be more efficient to let companies, after consultation with employee representatives, set retention periods that are duly justified in the IT Charter and register of processing activities, and to allow for exceptions in the event of special circumstances. This would reconcile the protection of privacy with the protection of other rights.
Noëlle Lenoir Avocats
28 boulevard Raspail
75007 PARIS
+33 1 45 44 67 16
contact@noellelenoir-avocats.com
Noêlle Lenoir Avocats ©2020 All rights reserved